I actually run everything as root. First thing I do with every Linux install is configure automatic logins, then log out, delete my home directory, symlink it to /root/, and change my username's user ID to 0. Tricks most of the software that pointlessly refuses to run as root into thinking that I'm not.

Never had anything go wrong. However, if I had, I don't see how not running as root would have made a damn bit of difference. So, what, the malware wouldn't be able to affect the system? Fuck the system, I can reinstall it. What I care about are all of my personal files which are 100% accessible to my user account.

...and what's more, everything malware cares about is accessible from my user account. It wants to send spam? My user account has network access. It wants to participate in a DDOS? My user account has network access. It wants to scan my personal files for sensitive information? My user account has access to my personal files. It wants to act as a keylogger to capture my banking password? My user account has the necessary access to do that. What exactly is malware missing out on by not being run as root?

So I always run as root. That way I don't have to play "simon says" with the command line, where I type "do something" and it replies "you didn't say 'sudo'" and so I type "sudo do something" and it finally does it. It's a pointless game as it doesn't protect me from anything, especially with the default settings where, after I type in my password, any sudo executions for the next five minutes get a free pass. Seems like any malware could just keep trying to run sudo until it works, assuming it had any reason whatsoever to give a fuck about the root account.

I'm really beginning to notice a trend with people who can't back up what they're saying simply telling me that I need to learn more.

I've made some arguments that support my belief that whether you run as root is irrelevant. Can you make some arguments that support your belief that it matters?

I don't mean sandboxing within Flash, I mean sandboxing at the OS level.

Executing a script is kind of sandboxing anyway. If the Flash developers screw that up, then that they also screw up a sandbox they tossed around it isn't much of a surprise. I'm sure they could add a few more sandboxes around that and still have things slip through.

What I mean is like how Linux is very good at preventing me from changing the system time without root permissions, perhaps when an ordinary user runs an application, it could be just as good at not letting that application open random files without the user's permission.

OSs are unforunately designed to serve applications, not users. If a program wants to intercept keystrokes sent to other applications so that it can catch your passwords, there's an API call for that. If a program wants to scan your entire filesystem looking for sensitive information, there's an API for that. If a program wants to run continuously without showing up in the GUI so that the user doesn't realize it's running, well, it doesn't even need an API call for that, as that's quite sadly the default.

Meanwhile, users have no easy way to see what the applications they're running are up to. Want to know if a program decides to access your personal files? Too bad, as not only does your OS not allow you to protect those files from random applications, it doesn't even offer you a way to see that an application is accessing those files. Want to know if any programs are currently piping data out to the internet? Hope you have a router with a useful link activity indicator, because your OS isn't going to tell you when your network is being used at all, never mind which programs are using it and how much they're using it, and it certainly isn't going to let you configure which programs can and cannot access the internet when you first run them, and it especially isn't going to give you easy-to-use fine-grained control over what the application is allowed to do (like blocking SMTP access to all programs by default, making it very difficult for any random software to become part of a spam botnet). Nope, the way you're supposed to ensure the security of your computer is to psychically know which programs are trustworthy and which are not.

To make this even more absurd, they then go to signed executables, so that we can trust that code came from someone we trust, because even if we honestly do trust Adobe to do nothing bad to our computers, and we're not simply using Adobe's code because we bought our computers because we need to get shit done and we can't get shit done if we don't run software, we've still go the issue that the completely trustworthy Adobe is rather incompetent and so even if they didn't intend for their software to do bad things, it will do bad things just as soon as someone figures out how to exploit it.

Obviously there's always the possibility for exploits, and so sandboxing won't be a perfect solution, but I think the kernel authors have a better track record in that regard than Adobe does. ...and of course, failing to do something at all isn't any better than trying to do it and being only 99% successful.

I've heard that Android almost did this correctly, with the list of app permissions you have to approve for each new app. The problem is that you then have to wonder why apps want each permission. So do you reject the app because it's asking for something you think it doesn't need, or do you assume (possibly correctly) that it has some feature which you haven't thought of that requires that permission and so it does have a legitimate reason to ask for it? If it were done correctly, you could just say no to any permission you don't want to grant, and the application would simply be told that it doesn't have it. Then if you go to use that feature, the application could tell you "I can't do that unless I have permission to access ____" at which point it either makes sense that it now needs that permission, or it still doesn't make sense and you can continue to say no while continuing to use the application for whatever else it is good for.

I mean, people buy computers to run software. It's dumb as fuck that they're then told "don't run software" because their operating systems are inadequately designed to deal with anything besides perfectly well-behaved software.

The saddest part of the whole deal is when I'm talking with kids about software programming and they want me to check out some program they've written and I then have to wonder "has this kid just discovered how to delete files and thinks it'd be a hilarious prank to delete them all?" Why can't I just run that program and trust that my OS isn't going to let it delete every file I own? I mean, just how many programs outside of my system's file manager do I want to have that kind of unrestricted access to my filesystem? It just doesn't make any sense that that kind of unrestricted access is the default, as I can think of very few pieces of software that need it, and every single one of them came with my OS, and so nothing I download needs that kind of access when I run it.

I'm not sure why you're imagining that this would be hard to do.

Granted, I haven't done video output, but I have done OpenGL output, and the OpenGL API is quite simple and there's nothing about it that enables one to take over the computer. I can have unrestricted access to the whole OpenGL API and all I'll be able to do with it is draw graphics on the screen, and being unable to do other things like read/write random files and capture keystrokes sent to other applications isn't going to affect my rendering speed at all.

Maybe the video APIs aren't presently designed the same way, but obviously for an idea to work well it has to be done right. I'm not suggesting we do it wrong.

I don't think Flash was ever about performance. If it was, someone forgot to tell its developers. I always thought its purpose was to fill in what some people thought were deficiencies in what web browsers were able to render, thus the vector graphic animations, and more recently, video support.

Would you even know? Perhaps if it's like Windows malware, where you end up with so much of it that the computer is unusable, but what if you only end up with one piece of malware which is careful to do things covertly?

Ten years ago you may have been able to spot malware with a simple "ps -A" but I don't even look at the output of that command anymore. There's so many processes running on my computer that any of them could be malware and I'd have no idea. ...and that's talking about malware that doesn't bother to hide itself by infecting another executable or at least adopting the same executable name as a daemon that's supposed to be running.

I'm curious why everyone thinks this matters. The only way I could see it making any difference is if you had a virus scanner, which could then run as root and be immune to any BS that the malware attempted as a normal user. ...but who has a Linux virus scanner? I know there's ClamAV, but I get the feeling it isn't for finding malware in Linux, it's for finding malware in email that passes through Linux. So what exactly do you prevent malware from doing by not allowing it access to the root account? Does it prevent it from accessing the internet to send spam? Does it prevent it from recording your keystrokes and sending them to someone else? Does it prevent it from accessing your microphone and bugging your house? Last I checked, I could record audio without 'sudo' and so I'm pretty sure a non-root piece of malware could do it too.

Telling people not to run processes as root is just ignoring real security solutions. Every application should be sandboxed, no matter what it is. For example, when I use a word processing application, why should it be able to read/write any file anywhere on my hard disk that I'm allowed to access? If it wants to read or write a file, it can make an API call that brings up a file open/save dialogee provided by the OS, which ensures that I'm giving it permission to access the files it reads or writes. As for storing settings and other random bits of data, the OS can provide it with a folder on the filesystem it has free access to, but to access anything outside of that, it needs to use the API for the file open/save dialogue. With this kind of security, you can open documents with all kinds of stupid scripting that takes over the entire application, but it's largely stopped right there, and can't access anything on the computer that you don't give that application permission to access. ...and it's all entirely transparent to the user, because they already open/save their files via a file open/save dialogue provided by the OS. The only thing that changes is that the open() system call is limited to a specific directory for each application to store it's settings/history data in. Very few applications need that sort of free access to the computer, and essentially all of them are provided by the OS itself, like the basic file manager, file archive/compression tools, etc. So it'd be easy to do, it'd provide real security, and yet rather than do that, all we do is tell people "as long as you don't run as root, you'll be perfectly secure" as if that makes any difference at all.

I mean, just imagine how secure Adobe Flash would be if it were sandboxed such that all it can do is get the web browser to perform HTTP requests on its behalf, and output audio and video? What would any exploit for it be able to do, besides make HTTP requests and display audio and video? ...but that's not how our computers work. For some reason our OSs allow applications we run to do anything at all that we ourselves are allowed to do on our computers, and everyone thinks that's not a problem.

If any modern OS had real security, you'd be able to download malware intentionally, run it just like you'd run any other application you want to use, and still remain safe since the malware would be unable to access anything you don't want it to access.

Do you win arguments like this?

I wrote a reply to everything you said, but as I was doing so, something kept telling me that I was just wasting my time. Then I saw that last comment and realized what it was. Nothing I say will change your mind. Can't quite figure out why I'm wrong? Well, just make logical errors like conflating distinct concepts like "occasionally required" with "popularity not declining," and where that doesn't feel like enough, just attack your opponent as well.

I imagine it might seem like you do win arguments that way, when people have the good sense to not bother to reply, and so you get the last word.

So we're stuck with email because people refuse to move on? Yeah, I'll agree with that.

Email will eventually die though. The young ones have already quit using it to communicate with friends. Newer businesses use newer protocols like RSS to distribute their news feeds. I'd have already ditched email entirely, except that too many people assume that an email address is something everyone has, and so without one you're a second-class citizen on the internet, barred from participating in online forums and from making online purchases.

Email is almost dead. I know too many people who, while they have an email account, it really isn't something they check every day. They just check it when they sign up for a web site account, or when they order something online, but otherwise ignore it as if it doesn't exist because it just isn't the best solution for anything it does, making it worthless for anything besides communicating with people who haven't yet figured that out.

Let me guess:

You often wake up to go to the bathroom, only to find once you're there that you really didn't need to go that badly. (Remember when you were a kid and you'd wake up in the morning almost ready to burst? That's normal. Waking up several times a night to empty a half-full bladder is not.)

Also, you sometimes have nightmares where you're running away from something, or doing anything that's physically exhausting, and then you wake up and breathe heavily for a while to catch your breath? (Guess what: Dreams are just imagination, they don't make you out of breath.)

I think you may have a sleep disorder. Specifically, either sleep apnea or upper airway resistance syndrome. In either event, lack of breathing will cause you to awaken, but by the time you're conscious, the problem is gone, so your mind doesn't know why you woke up. So it just blames the most annoying thing it can note at the moment: some really-not-that-loud noise, your not-that-uncomfortable matress, your half-full bladder, your kind-of-hungry stomach, or whatever. If it's bad enough, you'll end up so awake that you can't fall asleep again for hours.

The delayed sleep phase is due to your body having to make up some extra sleep, due to the poor quality. It wants to stay awake for 16 hours then sleep for 8, but ends up sleeping 9 or 10, and that just screws everything up.

You might also be able to get a guy with a broken foot to run if you chase him with a baseball bat, but no one would say that is because there's really nothing wrong with his foot. Cognitive behavioral therapy is bullshit. For those who aren't aware, it literally means "talk to the patient and figure out what they're doing wrong and tell them how to change it." So you keep suggesting shit until pure coincidence cures them (or merely makes them think they're cured) and take credit as obviously it was your advice that changed things, or you offer new advice every week until you're eventually forced to offer advice the patient just can't follow (like "get up in the morning anyway") at which point you can blame the therapy's failure on the patient's non-compliance. Like most of psychology, it's bullshit.

ADHD, though, is real. It just isn't what most doctor's think it is. There is one I saw on a television show who started testing kids with ADHD for sleep apnea, and cured quite a few of them of their ADHD with some oral surgery. Apparently he's the only person to think that poor sleep might result in kids who can't concentrate and who are hyperactive because being hyperactive is the only thing keeping them awake.

I actually think that most psychological problems are sleep disorders. Tired all the time, such that you can't improve your life or even enjoy it? That might make you depressed, right? ...and maybe, since your brain can't do sleep-things while you're asleep, it starts doing them while you're awake, and so you start having hallucinations. Then your sense of logic goes out the window, as it often does when people are asleep, and so everyone says you're delusional. I mean, just how many psychological conditions aren't known to be associated with sleep disturbances? Are there any?

...and then the drug of choice to treat ADHD is a stimulant. It's like we're just trying to keep the kids awake, to improve their concentration, and to make it so that they don't have to be so hyperactive in order to avoid falling asleep.

My guess is that the problem is that they sold out.

Simple fact is that the type of person Slashdot used to appeal to is like 1% of the population. The moment a web site catering to 1% of the population decides to become profitable, it's faced with a choice: Continue to serve that 1%, or change your content and appeal to a different but larger 2%, and after that, change it even more and appeal to 4% of the population. Never mind that you lost that original 1%, since you're only in it for the money.

Can't say I blame them. If I had a cool web site, and got to choose between having a cool web site or having a lot of money, I'd probably choose the money too. Of course, I'd probably also just go make another cool web site so that I could have both. It'd be nice if the Slashdot editors would do that so that the small portion of that original 1% which remains here can stop reading BS like this and just read their new site. It probably wouldn't even be any extra work for them, they could just take the Slashdot submissions they normally discard for being too intellectual and insufficiently emotional and just post them to their own site at the end of the day.

Just to add a "me too," I also have IPv6 support with Time Warner, which kind of surprises me as I live in the middle of nowhere and so I expected I'd be one of the last to see it.

Supposedly Time Warner is up to 10% deployment now, still behind Comcast's 30%, but no longer drastically far behind as they were in the past. http://www.worldipv6launch.org/measurements/ I think they were only at 7% the month before, but unfortunately that web site doesn't seem to keep the old data around.

It was quite hard to find that I even had IPv6. Time Warner's people don't even know what IPv6 is, so they can't tell you if you have it. My modem's status page has a line that says "Modem's IP Mode -- IPv4 Only" which for months made me think I didn't have it, but it turns out that that's irrelevant. Even after I discovered that IPv6 was there by using tcpdump and seeing IPv6 packets, it still took me all day to get Linux to recognize it and use it.

For some retarded reason, Linux doesn't accept IPv6 router advertisements when it is configured to route IPv6 packets. I still haven't figured out why anyone thought that it shouldn't. Doesn't a router need to know where to send its packets, and thus, it needs to accept router advertisements? Since I had been using a Hurricane Electric tunnel, and my computer had been routing IPv6 packets for the rest of the LAN, it was configured to be a router, and so it ignored my native IPv6. I eventually discovered there is a setting to make it accept router advertisements while also routing packets, but why it doesn't by default is a real mystery.

Pretty much everything I've done with IPv6 has been like that. The support is kind of there, but since it hasn't seen widespread use, the bugs haven't been worked out. Like router firmwares, even the open source ones, they may claim to support IPv6 but in reality it's just glued on and barely makes an appearance in the UI and where it does it often doesn't work correctly, like you can click on an IPv6 address that's a link to set up a static DHCP lease, but the page you're taken to to set it up has a text input field with a max length that doesn't permit the address to fit, and indeed even if it did it wouldn't work anyway.

The only thing I found that really works well is using pfSense, but even it has a few issues, like its inability to use DHCPv6 on your LAN if you obtained your IPv6 address via DHCPv6 (which you almost certainly did, as that's just how ISPs distribute addresses, even when they're static).

Anyway, while the ISPs have been dragging their feet on IPv6 for a long time, I don't think the router, application, and OS support is as great as everyone thinks. Seems more like it's just easy to pretend that it is since there's no IPv6 for anyone to use them with to know any differently. Indeed, it's likely part of the problem. If you're adding IPv6 support to something, the best you can do is test that it works with your specific IPv6 configuration, and so you'll know it works great with a Hurricane electric tunnel, but it isn't until someone tries to use it with native IPv6 that you'll figure out stuff like that routers need to accept router advertisements too.

A virtual machine is definitely the way to go. Paying $150 for a hideously under-powered computer, which you then struggle to find a new firmware for (because what came with it is garbage), trying to find one with the features you need that fits in the device's tiny memory, a chore which isn't made easier by the firmware authors because they just upload several dozen versions, all with little two-letter codes to specify which features they have, but with no key to the two-letter codes anywhere to be found so that you can only guess which versions have the features you want and which don't, and which will work in your router and which won't, all so that you can just try one and pray that it doesn't brick your $150 piece of shit, only to find that the firmware doesn't work as advertised and so you need to go find another... Well, it's just stupid. Fuck that bullshit.

I just tossed a second network card in my always-on-anyway PC, then installed pfSense in a VM, bridged both network adapters to the VM, and configured Linux to ignore the one that was connected to the cable modem, as the cable modem answers any DHCP request and so that's the only way to make sure the VM gets the global IP address. Worked wonderfully for the two months before my second network card died. Used only 2% of my CPU and RAM.

I've had people tell me "so how well does that work with 100 mbit internet service?" ...and I mean "tell me" as it wasn't a question. I really don't care. Simple fact is that I'm too poor for $150 routers, and in being so poor, I don't have 100 mbit internet service either. It works perfectly for what I need it to do, and so at least for me, the idea of wasting so much money on a router and so much time finding a firmware seems completely absurd, almost like everyone has forgotten that network switches exist and so you don't need a router to connect multiple computers together.

Indeed, the VM isn't strictly required either. You can technically make the Linux kernel do routing functions as well. The only problem there is that, aside from router firmware authors, no one else involved with Linux believes in ease of configuration. So you'll have to learn how to configure a dozen different tools, and despite what everyone says, plain text configuration files aren't magically easy to modify, you still have to know the syntax which is different with each and every one of them, and then you're still faced with problems like making the DHCPv6 server not hand out leases that are longer than the lease obtained by the DHCPv6 client, in case the routing prefix changes and so the IPv6 addresses on the LAN need to be renumbered. I tried for about two weeks to get all of the kernel's routing parameters, the DHCPv4 client, the DHCPv4 server, the DHCPv6 client, the DHCPv6 server, the router advertisement daemon, and a caching DNS server all working together before giving up. It's just a nightmare, and tossing pfSense in a VM is a far easier solution, even if it does add the unnecessary overhead of a VM.

The difference is whether or not you can give some to your friends and not have to worry about being arrested if the police find out. E.g., you can share your antibiotics, or your blood pressure medicine, even most antipsychotics. It isn't a good idea, but there's no law against it. On the other hand, those pain relievers, and most anti-anxiety and ADD medications are controlled substances, and sharing them will get you in trouble. It's a similar big deal for the doctors, as there's a lot more oversight of prescriptions for controlled substances and they can get in legal trouble for over-prescribing them, whereas if they over-prescribe other drugs, nothing will ever come of it.

It's all about how much energy someone has.

If you have energy and life is good, you'll make the most of it. You'll go on walks and play sports and otherwise get a lot of exercise, because those are all fun things to do. You'll cook healthy meals because all of the time it takes is no big deal and they taste so much better than frozen pizza. You'll keep looking for a better job rather than just sticking with the one you have. You'll totally be happy, healthy, and successful.

If you have no energy and life is good, then you can sit on your sofa all day watching T.V. and at least be some version of happy. You'll likely never exercise because you don't have the energy, and despite what everyone says, exercise doesn't give you energy, they're simply confusing correlation and causation. You'll eat nothing but frozen pizza because preparing food requires energy you don't have, as does cleaning dishes afterwards. Aluminum foil and paper plates will be your friends. ...but hey, at least you get to enjoy some good T.V. shows and eat some version of food so you're not starving.

If you have a lot of energy, and life is being a pain in the ass at the moment, you'll figure a way out. You'll spend a few hours every day looking for a job, or if you already have one, a better paying job. You'll also keep looking for a less expensive place to live. You'll make the most of your budget by preparing all of your meals from scratch. You'll walk / bicycle to work rather than drive to save gas. You'll spend an hour in front of the mirror every day making yourself as attractive as possible to potential employers. Whatever is wrong, you'll figure a way out of it.

However, if you don't have any energy, and life is constantly kicking you while you're already down, the only thing you can do is wonder if you shouldn't just end the pain because you certainly can't do anything else about it because doing anything requires energy. Even if you know that making home-made pizza costs only $1 per pizza, you just don't have the energy, especially after you get home from work, and so you're buying the $2 frozen pizza that tastes like shit. Even if you know that reducing your rent would help, looking for a new place to live is hard -- you looked for a few days, but didn't find anything, and it's really difficult to convince your brain which is constantly telling you "you need to conserve energy" that it needs to expend that energy to continue looking. So you're poor, and you stay poor, and you never get to take those fun walks and play fun sports because you just don't have that kind of energy. All you do is work hard in a low-paying job and come home and rest on the couch until it is time to go to sleep. Sometimes you try exercising anyway, but despite what everyone says, exercising regularly doesn't give you a lot of energy, and you wonder what crack they're smoking since you do have a job and so it isn't like you never get up and do anything. Indeed, no matter what you do, doing even the most simple things feels like an incredible chore. ...and to top it all off, no one wants to help, they all just want to criticize you, tell you that you're fat and lazy, that you're ugly (because you don't have the energy to spend an hour a day making yourself attractive to others), and that all of your problems are your own fault. You just can't be happy. So why not just get it all over with? You either live a miserable life, then die, or you can just die now.

Perhaps someday medicine will look into why these people don't have any energy, but for now it doesn't know and it's simply too easy to label them as lazy or crazy just to have a quick diagnosis and move on to the next patient.

Are you serious?

Well, just in case: I'm talking about spaces at the end of a line. The ones you can't even tell are there unless you're using one of those text editors which, if the spaces aren't there, will move your cursor down to the next line if you press the right arrow key.

With 'le' set to 'text' mode, you can move the cursor as far to the right of the line as you like, whether there are spaces there or not. When you type, if it needs to, it'll add enough spaces so that what your type can be where you've moved the cursor to. Then, when it saves the file, it'll strip off any unnecessary spaces at the end of lines.

My personal favorite is 'le' simply because its the only one I've found that doesn't obsess over whitespace. It isn't that way by default, you have to configure it from its 'exact' mode which is like most editors into 'text' mode, but at least it has the option unlike most editors. When in 'text' mode, when you push the right arrow while at the end of a line, the cursor just continues to go to the right, and doesn't do anything retarded like go down to the beginning of the next line.

Honestly, why nearly every editor does that, I have no idea. Just drives me fucking insane when I press the right arrow and the cursor goes to the left of the screen, or when I use the up/down arrows and the cursor completely disappears from anywhere I might look for it because the next line is longer/shorter than the previous one and so the editor has decided the cursor should now be at some other column. I don't care where spaces are or are not in the file. Indeed, I'd prefer the editor strip the file of all spaces not used for indentation when it saves, because spaces just don't fucking matter. Same with tabs, don't use them, just indent with spaces.

I wish I could find a GUI editor that works the same way, but aside from the author of 'le', everyone seems to think that where spaces are or are not in a text file is so critically important that anyone editing the file shouldn't be permitted the luxury of just putting the cursor where they want letters to be and typing them there, but instead they must be forced to add the spaces manually and only then be permitted to type what they want.

...and this is exactly what I'm talking about: Your explanation is no explanation either. If both twins see identical effects on space and time, then when they accelerate away from each other to come to a speed of 0.9 * c relative to their starting point, then each sees the other moving away at 1.8 c, but relativity tells us that can't happen.

For relativity's explanation of "the twin that goes away and comes back experiences time more slowly" to make sense, you essentially have to cherry-pick the simple case where everyone starts out in a stationary universe so that you can say "well, duh, obviously the twin that left and came back should experience time more slowly." Otherwise it's the case that someone passing us by may actually be experiencing time faster than us since they're "more at rest" than we are and we're the ones who are actually moving and therefore experiencing time more slowly. (...and yes, I know that relativity tells us that "more at rest" doesn't exist.) It's just a clusterfuck of contradiction and I don't get why everyone who tries to explain it tries to use something as painfully simplistic as "they would both age the same" to explain it. Anyone who can understand the twin paradox can obviously understand that that isn't a resolution of it, and that just makes me think that everyone who claims to understand relativity better than me (and believe me, I don't understand relativity at all) is just lying about it and they don't understand shit.